Read proxy CA bundles through RegularInRoot before accessing their contents.
Keep temporary writes and replacement confined to a retained root handle.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
(cherry picked from commit 914ed29f24515cf7dbfeff1c169538123945437b)
Propagate proxy CA cleanup failures from both Linux executors so builds
cannot succeed when the temporary certificate cannot be removed.
Restore certificate bundles byte-for-byte while preserving build-time changes
and report process and cleanup failures together.
Based on: moby/buildkit#7043
Co-authored-by: bbartels <23058572+bbartels@users.noreply.github.com>
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
(cherry picked from commit 62a1b69ee38bc68b23e7c096bbb7372ed13af6e1)
Open the proxy CA bundle with O_NONBLOCK before checking that it
is a regular file. This prevents cleanup from hanging when a build
replaces the bundle path with a FIFO that has no writer.
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
(cherry picked from commit ed6a9a02de11435e43a42efa6bbde835c08ebe3d)
(cherry picked from commit 567f0e193d2aefa47de3cb430b71946e8f68f40a)
Store the resolved certificate bundle target relative to the rootfs
and resolve it again during cleanup. This prevents cleanup from
following a container-retargeted symlink through the stale worker path.
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
(cherry picked from commit 573ec15277605de470a7c969b182b7ef4c495e7d)
(cherry picked from commit 51eb362664370570cd8f569ea76cd10ebf22fa0f)
Ref and rootfs helpers may read paths supplied by frontends or build outputs.
Reject non-regular files before reading them into memory so device and FIFO
paths cannot feed no-EOF streams into parsers or bundle injection logic.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Add a build request option that rewrites default exec networking to an
internal proxy network while preserving explicit none networking.
Route HTTP and HTTPS traffic through a BuildKit-owned proxy namespace, enforce
source policy checks for proxied requests, and inject a temporary CA into Linux
rootfs trust bundles for HTTPS interception.
Share namespace pooling between CNI and proxy providers, and cover proxy mode
with unit and integration tests.
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Tonis Tiigi